Launching an opt-in vulnerability-finding service for open-source software

We’re launching OSS Scanner , an opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing . Projects that join will receive thorough, periodic security scans by our strongest models at no cost.

Language models have rapidly advanced in their ability to discover vulnerabilities , as we have reported extensively on this blog. On CyberGym , one academic vulnerability-finding benchmark, LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports .

Over the last six months, we’ve used our latest models to scan for vulnerabilities in some of the world’s most important software projects. We have discovered over 29,000 candidate vulnerabilities , but have only been able to manually review and triage approximately 6,000 of these. While 6,000 vulnerabilities is significant, we remain bottlenecked on our human capacity to validate these findings.

We are working on scaling our vulnerability disclosures. Meanwhile, with increasing frequency, maintainers who receive our first reports simply ask us for a bulk submission of all the unverified reports with proposed patches: to date, we have sent nearly 5,000 reports directly to maintainers after they asked to receive everything we had—even if it wasn’t validated. Since exploits can now be developed in minutes , projects that can find and address vulnerabilities faster can better secure their software against attackers who are racing to find and leverage these same weaknesses.

We will continue to manually disclose human-verified vulnerability reports via our existing coordinated vulnerability disclosure (CVD) process , especially for projects without the resourcing to triage reports themselves. But we are now making available an optional fast-track for those who wish to receive vulnerability reports as soon as they become available.

Inspired by the positive impact on the open source ecosystem of Google's OSS-Fuzz , a project that scans open-source software for vulnerabilities with fuzzers, we are launching OSS Scanner to find vulnerabilities in open-source code with our strongest language models. While Claude Security , our general-access code scanning and patching product focuses on helping enterprises defend their systems, OSS Scanner provides security audits at no cost to open-source projects.